@agentvault/grok-bridge 0.4.0 → 0.4.1

package/dist/index.js

@@ -45899,6 +45899,11 @@ var init_ratchet = __esm2({
         return { header, headerSignature, ciphertext, nonce };
       }
       decrypt(message) {
+        if (this.state.peerIdentityPublicKey) {
+          if (!verifyHeaderSignature(message.header, message.headerSignature, this.state.peerIdentityPublicKey)) {
+            throw new Error("Header signature verification failed");
+          }
+        }
         const isV2 = message.envelopeVersion === "2.0.0" && message.encryptedHeader != null && message.headerNonce != null;
         const skippedResult = this.trySkippedKeys(message, isV2);
         if (skippedResult !== null) {
@@ -45912,14 +45917,14 @@ var init_ratchet = __esm2({
           if (message.header.messageNumber === 0) {
             try {
               const { messageKey: testKey, headerKey: testHeaderKey, nextChainKey: nextChainKey2 } = kdfChainKey(this.state.rootKey);
-              let ad2;
+              let ad;
               if (isV2) {
                 libsodium_wrappers_default.crypto_aead_xchacha20poly1305_ietf_decrypt(null, message.encryptedHeader, null, message.headerNonce, testHeaderKey);
-                ad2 = message.encryptedHeader;
+                ad = message.encryptedHeader;
               } else {
-                ad2 = serializeHeader(message.header);
+                ad = serializeHeader(message.header);
               }
-              const ptBytes = libsodium_wrappers_default.crypto_aead_xchacha20poly1305_ietf_decrypt(null, message.ciphertext, ad2, message.nonce, testKey);
+              const ptBytes = libsodium_wrappers_default.crypto_aead_xchacha20poly1305_ietf_decrypt(null, message.ciphertext, ad, message.nonce, testKey);
               this.state.dhReceivingPublicKey = message.header.dhPublicKey;
               this.state.receivingChain = {
                 chainKey: nextChainKey2,
@@ -45939,13 +45944,7 @@ var init_ratchet = __esm2({
         this.skipMessages(this.state.receivingChain, message.header.messageNumber, message.header.dhPublicKey, isV2);
         const chain = this.state.receivingChain;
         const { nextChainKey, messageKey, headerKey } = kdfChainKey(chain.chainKey);
-        chain.chainKey = nextChainKey;
-        chain.messageNumber++;
-        if (this.state.peerIdentityPublicKey) {
-          if (!verifyHeaderSignature(message.header, message.headerSignature, this.state.peerIdentityPublicKey)) {
-            throw new Error("Header signature verification failed");
-          }
-        }
+        let plaintextBytes;
         if (isV2) {
           try {
             libsodium_wrappers_default.crypto_aead_xchacha20poly1305_ietf_decrypt(null, message.encryptedHeader, null, message.headerNonce, headerKey);
@@ -45953,19 +45952,21 @@ var init_ratchet = __esm2({
             throw new Error("V2 header decryption failed");
           }
           try {
-            const plaintextBytes = libsodium_wrappers_default.crypto_aead_xchacha20poly1305_ietf_decrypt(null, message.ciphertext, message.encryptedHeader, message.nonce, messageKey);
-            return libsodium_wrappers_default.to_string(plaintextBytes);
+            plaintextBytes = libsodium_wrappers_default.crypto_aead_xchacha20poly1305_ietf_decrypt(null, message.ciphertext, message.encryptedHeader, message.nonce, messageKey);
           } catch {
             throw new Error("V2 decryption failed: ciphertext tampered or wrong key");
           }
+        } else {
+          const ad = serializeHeader(message.header);
+          try {
+            plaintextBytes = libsodium_wrappers_default.crypto_aead_xchacha20poly1305_ietf_decrypt(null, message.ciphertext, ad, message.nonce, messageKey);
+          } catch {
+            throw new Error("Decryption failed: ciphertext tampered or wrong key");
+          }
         }
-        const ad = serializeHeader(message.header);
-        try {
-          const plaintextBytes = libsodium_wrappers_default.crypto_aead_xchacha20poly1305_ietf_decrypt(null, message.ciphertext, ad, message.nonce, messageKey);
-          return libsodium_wrappers_default.to_string(plaintextBytes);
-        } catch {
-          throw new Error("Decryption failed: ciphertext tampered or wrong key");
-        }
+        chain.chainKey = nextChainKey;
+        chain.messageNumber++;
+        return libsodium_wrappers_default.to_string(plaintextBytes);
       }
       dhRatchetReceive(theirDhPublic) {
         this.state.previousSendingChainLength = this.state.sendingChain?.messageNumber ?? 0;
@@ -64139,6 +64140,23 @@ var init_mls_delivery_order = __esm2({
     "use strict";
   }
 });
+function noteObservedEpoch(current, seen) {
+  const n2 = Number(seen);
+  if (!Number.isInteger(n2) || n2 < 0)
+    return current;
+  return n2 > current ? n2 : current;
+}
+function needsPreSendResync(localEpoch, observedEpoch) {
+  if (!Number.isInteger(localEpoch) || !Number.isInteger(observedEpoch)) {
+    return false;
+  }
+  return observedEpoch > localEpoch;
+}
+var init_mls_presend_epoch = __esm2({
+  "../crypto/dist/mls-presend-epoch.js"() {
+    "use strict";
+  }
+});
 var dist_exports = {};
 __export2(dist_exports, {
   AV_CREDENTIAL_CONTEXT: () => AV_CREDENTIAL_CONTEXT,
@@ -64208,7 +64226,9 @@ __export2(dist_exports, {
   hexTransportToEncryptedMessage: () => hexTransportToEncryptedMessage,
   issueCredential: () => issueCredential,
   multibaseToPublicKey: () => multibaseToPublicKey,
+  needsPreSendResync: () => needsPreSendResync,
   normalizeBackupCode: () => normalizeBackupCode,
+  noteObservedEpoch: () => noteObservedEpoch,
   orderDeliveryBatch: () => orderDeliveryBatch,
   parseTraceparent: () => parseTraceparent,
   performX3DH: () => performX3DH,
@@ -64248,6 +64268,7 @@ var init_dist = __esm2({
     init_mls_group();
     await init_owner_sync();
     init_mls_delivery_order();
+    init_mls_presend_epoch();
   }
 });
 async function ensureSecureDir(dir) {
@@ -64440,7 +64461,7 @@ var init_mls_kp_pool = __esm2({
   }
 });
 function ownIdentity() {
-  const v2 = true ? "0.23.23" : FALLBACK;
+  const v2 = true ? "0.23.27" : FALLBACK;
   return `${PACKAGE}@${v2}`;
 }
 function buildClientVersion(override) {
@@ -65356,6 +65377,7 @@ var init_channel = __esm2({
     await init_libsodium_wrappers();
     await init_dist();
     await init_dist();
+    init_mls_presend_epoch();
     init_mls_state();
     await init_mls_kp_pool();
     init_client_version();
@@ -65469,6 +65491,17 @@ var init_channel = __esm2({
        *  self-heal rather than be logged and dropped. */
       _mlsCommitFailCounts = /* @__PURE__ */ new Map();
       static MAX_MLS_DECRYPT_FAILS = 3;
+      /**
+       * #1084: consecutive resyncs that found NOTHING to apply, per group.
+       *
+       * "No new commits" means the server holds no commit past our epoch — we are
+       * NOT BEHIND. Treating that as corruption and re-keying is what drove the
+       * epoch churn (see `_resyncOnDivergence`). But a state that is genuinely
+       * broken while its epoch counter happens to match must still recover, so the
+       * suppression is bounded rather than absolute.
+       */
+      _resyncNoOpStrikes = /* @__PURE__ */ new Map();
+      static MAX_RESYNC_NOOPS = 3;
       /** Cached MLS KeyPackage bundle for this device (regenerated on each connect). */
       _mlsKeyPackage = null;
       /** Pending KeyPackage bundle from request-Welcome flow (used by _handleMlsWelcome). */
@@ -65506,6 +65539,13 @@ var init_channel = __esm2({
       _kpPoolFilling = false;
       /** Buffer for MLS commits received before Welcome (keyed by groupId, sorted by epoch). */
       _pendingMlsCommits = /* @__PURE__ */ new Map();
+      /**
+       * #1013: the highest group epoch any inbound frame has reported, per MLS
+       * group id. Every inbound frame carries the epoch the group was at when it
+       * was produced, so each is a LOWER BOUND on the group's current epoch — the
+       * hint is monotonic and only ever rises.
+       */
+      _observedGroupEpochs = /* @__PURE__ */ new Map();
       /** In-memory credential store for renter-provided credentials (never persisted). */
       _credentialStore = new CredentialStore();
       /** Rooms whose roster has been refreshed from the backend at least once in
@@ -66190,16 +66230,44 @@ var init_channel = __esm2({
         const pendingWsSends = [];
         const sentSharedGroupIds = /* @__PURE__ */ new Set();
         const addressedMlsGroupIds = [];
+        if (!(this._persisted?.mlsGroups && this._state === "ready" && this._ws)) {
+          console.warn(
+            `[SecureChannel] send(): shared-MLS block SKIPPED \u2014 mlsGroups=${this._persisted?.mlsGroups ? Object.keys(this._persisted.mlsGroups).length : "none"} state=${this._state} ws=${this._ws ? "open" : "null"}`
+          );
+        }
         if (this._persisted?.mlsGroups && this._state === "ready" && this._ws) {
           const targetSharedGid = targetConvId ? this._sessionGroupIds?.get(targetConvId) : void 0;
+          console.log(
+            `[SecureChannel] send(): considering ${Object.keys(this._persisted.mlsGroups).length} shared group(s); targetConvId=${targetConvId ? targetConvId.slice(0, 8) : "(none \u2014 broadcast)"} targetSharedGid=${targetSharedGid ? targetSharedGid.slice(0, 8) : "(none)"}`
+          );
+          const skipped = [];
           for (const [gid, entry] of Object.entries(this._persisted.mlsGroups)) {
-            if (targetConvId && gid !== targetSharedGid) continue;
-            if (!entry.mlsGroupId) continue;
+            if (targetConvId && gid !== targetSharedGid) {
+              skipped.push(`${gid.slice(0, 8)}:not-target`);
+              continue;
+            }
+            if (!entry.mlsGroupId) {
+              skipped.push(`${gid.slice(0, 8)}:no-mlsGroupId`);
+              continue;
+            }
             const mlsGroup = this._mlsGroups.get(`1to1-group:${gid}`);
-            if (!mlsGroup?.isInitialized || Number(mlsGroup.epoch) <= 0) continue;
+            if (!mlsGroup?.isInitialized) {
+              skipped.push(`${gid.slice(0, 8)}:not-in-memory`);
+              continue;
+            }
+            if (Number(mlsGroup.epoch) <= 0) {
+              skipped.push(`${gid.slice(0, 8)}:epoch<=0`);
+              continue;
+            }
             try {
               const plaintextBytes = new TextEncoder().encode(plaintext);
-              const cipherBytes = await mlsGroup.encrypt(plaintextBytes);
+              const cipherBytes = await this._encryptWithCatchUp(
+                mlsGroup,
+                `1to1-group:${gid}`,
+                entry.mlsGroupId,
+                `1:1 group ${gid.slice(0, 8)}`,
+                plaintextBytes
+              );
               await saveMlsState(this.config.dataDir, entry.mlsGroupId, JSON.stringify(mlsGroup.exportState()));
               const payload = {
                 group_id: entry.mlsGroupId,
@@ -66221,8 +66289,12 @@ var init_channel = __esm2({
               console.log(`[SecureChannel] Shared MLS group send for group ${gid.slice(0, 8)} (${entry.mlsGroupId.slice(0, 8)})`);
             } catch (err) {
               console.error(`[SecureChannel] Shared MLS group send failed for ${gid.slice(0, 8)}:`, err);
+              skipped.push(`${gid.slice(0, 8)}:encrypt-threw`);
             }
           }
+          if (skipped.length > 0) {
+            console.log(`[SecureChannel] send(): skipped ${skipped.length} group(s) \u2014 ${skipped.join(", ")}`);
+          }
         }
         for (const [convId, session] of this._sessions) {
           if (!session.activated) continue;
@@ -66242,7 +66314,14 @@ var init_channel = __esm2({
             }
             if (mlsGroup?.isInitialized && mlsGroupId && Number(mlsGroup.epoch) > 0 && this._state === "ready" && this._ws) {
               const plaintextBytes = new TextEncoder().encode(plaintext);
-              const cipherBytes = await mlsGroup.encrypt(plaintextBytes);
+              const sessionGroupKey = convGroupId && this._mlsGroups.has(`1to1-group:${convGroupId}`) ? `1to1-group:${convGroupId}` : `conv:${convId}`;
+              const cipherBytes = await this._encryptWithCatchUp(
+                mlsGroup,
+                sessionGroupKey,
+                mlsGroupId,
+                `conversation ${convId.slice(0, 8)}`,
+                plaintextBytes
+              );
               await saveMlsState(this.config.dataDir, mlsGroupId, JSON.stringify(mlsGroup.exportState()));
               const payload = {
                 conversation_id: convId,
@@ -66337,7 +66416,14 @@ var init_channel = __esm2({
             }
             try {
               const plaintextBytes = new TextEncoder().encode(plaintext);
-              const cipherBytes = await mlsGroup.encrypt(plaintextBytes);
+              const mlsOnlyGroupKey = mlsOnlyConvGroupId && this._mlsGroups.has(`1to1-group:${mlsOnlyConvGroupId}`) ? `1to1-group:${mlsOnlyConvGroupId}` : `conv:${mlsConvId}`;
+              const cipherBytes = await this._encryptWithCatchUp(
+                mlsGroup,
+                mlsOnlyGroupKey,
+                resolvedMlsGroupId,
+                `conversation ${mlsConvId.slice(0, 8)}`,
+                plaintextBytes
+              );
               await saveMlsState(this.config.dataDir, resolvedMlsGroupId, JSON.stringify(mlsGroup.exportState()));
               const payload = {
                 conversation_id: mlsConvId,
@@ -66363,13 +66449,26 @@ var init_channel = __esm2({
             }
           }
         }
-        if (sentCount === 0 && this._sessions.size > 0) {
-          console.warn("[SecureChannel] send() delivered to 0 sessions (all skipped or failed)");
+        if (sentCount === 0) {
+          console.warn(
+            `[SecureChannel] send() delivered to 0 destinations \u2014 nothing was encrypted or queued (sessions=${this._sessions.size}, sharedGroups=${this._persisted?.mlsGroups ? Object.keys(this._persisted.mlsGroups).length : 0})`
+          );
         }
         await this._persistState();
+        const wsReady = this._ws?.readyState === 1;
+        if (pendingWsSends.length > 0 && !wsReady) {
+          console.warn(
+            `[SecureChannel] send(): ${pendingWsSends.length} frame(s) NOT written \u2014 socket readyState=${this._ws?.readyState ?? "null"} (1=OPEN)`
+          );
+        }
         for (const frame of pendingWsSends) {
           this._ws.send(frame);
         }
+        if (pendingWsSends.length > 0) {
+          console.log(
+            `[SecureChannel] send(): wrote ${pendingWsSends.length} frame(s) to the socket (sentCount=${sentCount}, readyState=${this._ws?.readyState ?? "null"})`
+          );
+        }
         if (!options?.isResend) {
           for (const mlsGroupId of addressedMlsGroupIds) {
             this._rememberRetryCandidate(mlsGroupId, plaintext, options);
@@ -66419,7 +66518,7 @@ var init_channel = __esm2({
        */
       sendActivitySpan(spanData) {
         if (!this._ws || this._ws.readyState !== WebSocket.OPEN) return;
-        const pluginVersion = true ? "0.23.23" : "0.0.0-dev";
+        const pluginVersion = true ? "0.23.27" : "0.0.0-dev";
         const agentName = this.config.agentName ?? "Agent";
         const resource = {
           "service.name": "agentvault-agent",
@@ -66629,7 +66728,13 @@ var init_channel = __esm2({
           if (mlsGroup?.isInitialized) {
             try {
               const plaintextBytes = new TextEncoder().encode(plaintext);
-              const ciphertext = await mlsGroup.encrypt(plaintextBytes);
+              const ciphertext = await this._encryptWithCatchUp(
+                mlsGroup,
+                roomId,
+                room.mlsGroupId,
+                `room ${roomId.slice(0, 8)}`,
+                plaintextBytes
+              );
               await saveMlsState(this.config.dataDir, room.mlsGroupId, JSON.stringify(mlsGroup.exportState()));
               if (this._state === "ready" && this._ws) {
                 this._ws.send(JSON.stringify({
@@ -66880,11 +66985,17 @@ var init_channel = __esm2({
         const before = this._persisted.groupId;
         this._sessionGroupIds = new Map(mine.map((r2) => [r2.id, r2.group_id]));
         this._persisted.conversationGroupIds = Object.fromEntries(this._sessionGroupIds);
-        const primary = mine.find((r2) => r2.id === this._persisted.primaryConversationId) ?? mine[0];
+        const joined = mine.find((r2) => this._persisted.mlsGroups?.[r2.group_id]);
+        const primary = mine.find((r2) => r2.id === this._persisted.primaryConversationId) ?? joined ?? mine[0];
+        if (!mine.some((r2) => r2.id === this._persisted.primaryConversationId)) {
+          console.log(
+            `[SecureChannel] Adopting new primary conversation ${primary.id.slice(0, 8)} (group ${primary.group_id.slice(0, 8)}) \u2014 ${joined ? "we hold MLS state for it" : "no joined conversation found, first active row"}`
+          );
+        }
         this._persisted.groupId = primary.group_id;
         this._persisted.primaryConversationId = primary.id;
         const liveGroupIds = new Set(mine.map((r2) => r2.group_id));
-        if (!liveGroupIds.has(staleGid)) {
+        if (staleGid && staleMlsGroupId && !liveGroupIds.has(staleGid)) {
           try {
             await deleteMlsState(this.config.dataDir, staleMlsGroupId);
           } catch {
@@ -66898,9 +67009,9 @@ var init_channel = __esm2({
         }
         await this._persistState();
         console.log(
-          `[SecureChannel] Re-resolved conversation groups after 'unknown group' ${staleMlsGroupId.slice(0, 8)}: primary group ${String(before).slice(0, 8)} \u2192 ${this._persisted.groupId.slice(0, 8)} (${mine.length} active conversation(s))`
+          `[SecureChannel] Re-resolved conversation groups ${staleMlsGroupId ? `after 'unknown group' ${staleMlsGroupId.slice(0, 8)}` : "on connect (#1034)"}: primary group ${String(before).slice(0, 8)} \u2192 ${this._persisted.groupId.slice(0, 8)} (${mine.length} active conversation(s))`
         );
-        return this._persisted.groupId !== before && before === staleGid;
+        return staleGid !== void 0 && this._persisted.groupId !== before && before === staleGid;
       }
       /**
        * Resend the message that a now-reconciled `unknown group` refusal killed (#732).
@@ -67808,7 +67919,13 @@ var init_channel = __esm2({
           const mlsGroup = this._mlsGroups.get(`a2a:${channelEntry.channelId}`);
           if (mlsGroup?.isInitialized) {
             const plaintextBytes = new TextEncoder().encode(text);
-            const ciphertext = await mlsGroup.encrypt(plaintextBytes);
+            const ciphertext = await this._encryptWithCatchUp(
+              mlsGroup,
+              `a2a:${channelEntry.channelId}`,
+              channelEntry.mlsGroupId,
+              `A2A ${channelEntry.channelId.slice(0, 8)}`,
+              plaintextBytes
+            );
             await saveMlsState(
               this.config.dataDir,
               channelEntry.mlsGroupId,
@@ -67856,7 +67973,13 @@ var init_channel = __esm2({
           const mlsGroup = this._mlsGroups.get(`a2a:${channelId}`);
           if (mlsGroup?.isInitialized) {
             const plaintextBytes = new TextEncoder().encode(text);
-            const ciphertext = await mlsGroup.encrypt(plaintextBytes);
+            const ciphertext = await this._encryptWithCatchUp(
+              mlsGroup,
+              `a2a:${channelId}`,
+              entry.mlsGroupId,
+              `A2A ${channelId.slice(0, 8)}`,
+              plaintextBytes
+            );
             await saveMlsState(this.config.dataDir, entry.mlsGroupId, JSON.stringify(mlsGroup.exportState()));
             this._ws.send(JSON.stringify({
               event: "a2a_message_mls",
@@ -68302,6 +68425,9 @@ var init_channel = __esm2({
             await this._pullDrDeliveryQueue();
             await this._flushOutboundQueue();
             this._setState("ready");
+            void this._reconcileConversationGroups().catch((err) => {
+              console.warn("[SecureChannel] Conversation-group reconcile failed:", err);
+            });
             void this._reconcileRoomsWithServer().catch(
               (err) => console.warn(`[SecureChannel] room reconcile failed (ignored): ${err instanceof Error ? err.message : String(err)}`)
             ).then(() => this._quarantineOrphanedMlsGroups()).catch(
@@ -68329,7 +68455,7 @@ var init_channel = __esm2({
                 agentVersion: this.config.agentVersion ?? "0.0.0",
                 // __AV_VERSION__ is injected by esbuild from package.json at build time.
                 // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                pluginVersion: true ? "0.23.23" : "0.0.0-dev"
+                pluginVersion: true ? "0.23.27" : "0.0.0-dev"
               });
               this._telemetryReporter.startAutoFlush(3e4);
             }
@@ -68653,7 +68779,7 @@ var init_channel = __esm2({
                     agentVersion: this.config.agentVersion ?? "0.0.0",
                     // __AV_VERSION__ is injected by esbuild from package.json at build time.
                     // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                    pluginVersion: true ? "0.23.23" : "0.0.0-dev"
+                    pluginVersion: true ? "0.23.27" : "0.0.0-dev"
                   });
                   this._telemetryReporter.startAutoFlush(3e4);
                 }
@@ -69019,6 +69145,7 @@ var init_channel = __esm2({
         const convGroupId = data.conversation_group_id;
         const groupId = data.group_id;
         const senderDeviceId = data.sender_device_id;
+        this._noteGroupEpoch(groupId, data.epoch);
         if (senderDeviceId === this._deviceId) return;
         let mgr;
         let mgrKey;
@@ -69096,9 +69223,15 @@ var init_channel = __esm2({
                 })),
                 no_history: filtered.length === 0
               });
-              if (mgr && mlsGroupId) {
+              if (mgr && mgrKey && mlsGroupId) {
                 const responseBytes = new TextEncoder().encode(responsePayload);
-                const cipher = await mgr.encrypt(responseBytes);
+                const cipher = await this._encryptWithCatchUp(
+                  mgr,
+                  mgrKey,
+                  mlsGroupId,
+                  `history catch-up ${mlsGroupId.slice(0, 8)}`,
+                  responseBytes
+                );
                 await saveMlsState(this.config.dataDir, mlsGroupId, JSON.stringify(mgr.exportState()));
                 if (this._ws) {
                   this._ws.send(JSON.stringify({
@@ -69841,9 +69974,36 @@ ${messageText}`;
       // ---------------------------------------------------------------------------
       // MLS room message handlers
       // ---------------------------------------------------------------------------
+      /**
+       * #1014: hand a room-framed frame to the handler that owns its group family.
+       *
+       * Returns true when the frame was routed. Routing means "give it to the right
+       * handler" — NOT "decrypt it as a room message". Decrypting under the wrong
+       * group is how MLS state gets corrupted, so an unplaceable group is left for
+       * the caller to self-heal rather than guessed at.
+       */
+      async _routeNonRoomGroupMessage(data, groupId) {
+        const target = this._resolveGroupFamily(groupId);
+        if (!target || target.family === "room") return false;
+        console.log(
+          `[SecureChannel] Room-framed message belongs to ${target.label} \u2014 routing to the handler that owns it (#1014)`
+        );
+        switch (target.family) {
+          case "shared1to1":
+            await this._handleMessageMLS({ ...data, conversation_group_id: target.id });
+            return true;
+          case "conversation":
+            await this._handleMessageMLS({ ...data, conversation_id: target.id });
+            return true;
+          case "a2a":
+            await this._handleA2AMessageMLS({ ...data, a2a_channel_id: target.id });
+            return true;
+        }
+      }
       async _handleRoomMessageMLS(data) {
         const groupId = data.group_id;
         const senderDeviceId = data.sender_device_id;
+        this._noteGroupEpoch(groupId, data.epoch);
         if (senderDeviceId === this._deviceId) return;
         let roomId;
         for (const [rid, room] of Object.entries(this._persisted?.rooms ?? {})) {
@@ -69857,7 +70017,9 @@ ${messageText}`;
             roomId = data.room_id;
             console.log(`[SecureChannel] Room ${roomId.slice(0, 8)} matched by room_id (group_id ${groupId?.slice(0, 8)} mismatch)`);
           } else {
+            if (await this._routeNonRoomGroupMessage(data, groupId)) return;
             console.warn(`[SecureChannel] No room found for MLS group ${groupId?.slice(0, 8)}`);
+            if (groupId) void this._requestWelcomeSelfHeal(groupId);
             return;
           }
         }
@@ -70045,63 +70207,63 @@ ${messageText}`;
           console.warn(`[SecureChannel] Failed to send history catchup response:`, sendErr);
         }
       }
+      /**
+       * Apply an inbound MLS commit to whichever group it addresses.
+       *
+       * Returns TRUE when the commit was applied, buffered, or handed to the
+       * failure ladder — i.e. when this agent has taken responsibility for it and
+       * the delivery-queue row may safely be acked. Returns FALSE when the commit
+       * names a group we hold no state for at all, so the caller must NACK and let
+       * the row survive.
+       *
+       * #1012: this used to loop `rooms` then `a2aChannels` and then END. A shared
+       * 1:1 commit (`mlsGroups`) and a legacy per-conversation commit
+       * (`mlsConversations`) matched neither. The call fell off the bottom with no
+       * log, no buffer and no error — and because it did not THROW,
+       * `_pullDeliveryQueue` acked the row and the server deleted it. An MLS commit
+       * cannot be regenerated, so the agent stayed at epoch N while the group moved
+       * to N+1 and every later send() encrypted at an epoch nobody could decrypt.
+       *
+       * The families are enumerated in ONE list resolved by ONE loop, because two
+       * hand-copied loops are exactly how the 1:1 path fell two families behind.
+       */
       async _handleMlsCommit(data) {
         const groupId = data.group_id;
         const epoch = typeof data.epoch === "number" ? data.epoch : 0;
-        for (const [roomId, room] of Object.entries(this._persisted?.rooms ?? {})) {
-          if (room.mlsGroupId === groupId) {
-            const mlsGroup = this._mlsGroups.get(roomId);
-            if (mlsGroup?.isInitialized) {
-              try {
-                const commitBytes = new Uint8Array(Buffer.from(data.payload, "hex"));
-                await mlsGroup.processCommit(commitBytes);
-                await saveMlsState(this.config.dataDir, groupId, JSON.stringify(mlsGroup.exportState()));
-                console.log(`[SecureChannel] MLS commit processed for room ${roomId.slice(0, 8)} (epoch=${mlsGroup.epoch})`);
-                this._mlsCommitFailCounts.delete(roomId);
-              } catch (err) {
-                await this._onCommitFailure(
-                  roomId,
-                  groupId,
-                  err,
-                  `room ${roomId.slice(0, 8)}`,
-                  data.epoch,
-                  mlsGroup.epoch
-                );
-              }
-            } else {
-              this._bufferMlsCommit(groupId, epoch, data);
-              console.log(`[SecureChannel] Buffered MLS commit for room ${roomId.slice(0, 8)} (epoch=${epoch}, group not initialized)`);
-            }
-            return;
+        this._noteGroupEpoch(groupId, data.epoch);
+        const target = this._resolveGroupFamily(groupId);
+        if (target) {
+          const { managerKey: groupKey, label } = target;
+          const mlsGroup = this._mlsGroups.get(groupKey);
+          if (!mlsGroup?.isInitialized) {
+            this._bufferMlsCommit(groupId, epoch, data);
+            console.log(`[SecureChannel] Buffered MLS commit for ${label} (epoch=${epoch}, group not initialized)`);
+            return true;
           }
-        }
-        for (const [chId, chState] of Object.entries(this._persisted?.a2aChannels ?? {})) {
-          if (chState.mlsGroupId === groupId) {
-            const mlsGroup = this._mlsGroups.get(`a2a:${chId}`);
-            if (mlsGroup?.isInitialized) {
-              try {
-                const commitBytes = new Uint8Array(Buffer.from(data.payload, "hex"));
-                await mlsGroup.processCommit(commitBytes);
-                await saveMlsState(this.config.dataDir, groupId, JSON.stringify(mlsGroup.exportState()));
-                console.log(`[SecureChannel] MLS commit processed for A2A ${chId.slice(0, 8)} (epoch=${mlsGroup.epoch})`);
-                this._mlsCommitFailCounts.delete(`a2a:${chId}`);
-              } catch (err) {
-                await this._onCommitFailure(
-                  `a2a:${chId}`,
-                  groupId,
-                  err,
-                  `A2A ${chId.slice(0, 8)}`,
-                  data.epoch,
-                  mlsGroup.epoch
-                );
-              }
-            } else {
-              this._bufferMlsCommit(groupId, epoch, data);
-              console.log(`[SecureChannel] Buffered MLS commit for A2A ${chId.slice(0, 8)} (epoch=${epoch}, group not initialized)`);
-            }
-            return;
+          try {
+            const commitBytes = new Uint8Array(Buffer.from(data.payload, "hex"));
+            await mlsGroup.processCommit(commitBytes);
+            await saveMlsState(this.config.dataDir, groupId, JSON.stringify(mlsGroup.exportState()));
+            console.log(`[SecureChannel] MLS commit processed for ${label} (epoch=${mlsGroup.epoch})`);
+            this._mlsCommitFailCounts.delete(groupKey);
+          } catch (err) {
+            await this._onCommitFailure(
+              groupKey,
+              groupId,
+              err,
+              label,
+              data.epoch,
+              mlsGroup.epoch
+            );
           }
+          return true;
         }
+        this._bufferMlsCommit(groupId, epoch, data);
+        console.warn(
+          `[SecureChannel] MLS commit for UNKNOWN group ${String(groupId).slice(0, 8)} (epoch=${epoch}) \u2014 buffered, requesting a Welcome, NOT acked`
+        );
+        if (groupId) void this._requestWelcomeSelfHeal(groupId);
+        return false;
       }
       /** Buffer an MLS commit for replay after Welcome join. Max 50 per group. */
       _bufferMlsCommit(groupId, epoch, data) {
@@ -70291,6 +70453,229 @@ ${messageText}`;
        *   `1to1-group:<gid>`, `a2a:<channelId>`, …) — also the decrypt-fail-count key.
        * @param groupId  the server-side MLS group id used in the /sync URL.
        */
+      /**
+       * #1015 — the ONLY place this package fulfils a Welcome request.
+       *
+       * Add the members, transmit, and record `fulfilled` **only for the targets
+       * whose frames actually went out**. Every one of the five sites that used to
+       * do this by hand followed the same sequence and had the same three holes:
+       * `this._ws` null (both sends skipped by an `if`), a CLOSING socket (`send`
+       * returns without throwing), and a fulfil POST wrapped in `.catch(() => {})`.
+       *
+       * A fulfilled request is never re-requested. So a Welcome that evaporated
+       * left the requester locked out, the fulfiller at epoch N+1, everyone else at
+       * N, and the bridging commit untransmitted and impossible to regenerate — a
+       * permanently wedged group in which every signal read success.
+       *
+       * Returns the number of requests actually fulfilled.
+       */
+      async _fulfilWelcomeRequests(opts) {
+        const { mlsGroup, mlsGroupId, label, welcomeFields, targets } = opts;
+        if (targets.length === 0) return 0;
+        if (!this._wsIsOpen()) {
+          console.warn(
+            `[SecureChannel] ${label}: socket is not OPEN \u2014 NOT advancing the group; ${targets.length} request(s) stay pending for the next pull`
+          );
+          return 0;
+        }
+        const snapshot = mlsGroup.exportState();
+        const { commit, welcome } = await mlsGroup.addMembers(targets.map((t2) => t2.keyPackage));
+        const commitSent = await this._sendFrameConfirmed(
+          {
+            event: "mls_commit",
+            data: {
+              group_id: mlsGroupId,
+              epoch: Number(mlsGroup.epoch),
+              payload: Buffer.from(commit).toString("hex")
+            }
+          },
+          `${label} commit`
+        );
+        if (!commitSent) {
+          mlsGroup.importState(snapshot);
+          console.warn(
+            `[SecureChannel] ${label}: commit was NOT written \u2014 rolled back to epoch ${Number(mlsGroup.epoch)}, nothing fulfilled, requests stay pending`
+          );
+          return 0;
+        }
+        await saveMlsState(this.config.dataDir, mlsGroupId, JSON.stringify(mlsGroup.exportState()));
+        if (!welcome) {
+          console.warn(
+            `[SecureChannel] ${label}: addMembers produced NO Welcome \u2014 ${targets.length} request(s) left pending rather than marked fulfilled`
+          );
+          return 0;
+        }
+        let fulfilled = 0;
+        for (const t2 of targets) {
+          const sent = await this._sendFrameConfirmed(
+            {
+              event: "mls_welcome",
+              data: {
+                target_device_id: t2.deviceId,
+                group_id: mlsGroupId,
+                ...welcomeFields,
+                payload: Buffer.from(welcome).toString("hex")
+              }
+            },
+            `${label} welcome\u2192${t2.deviceId.slice(0, 8)}`
+          );
+          if (!sent) {
+            console.warn(
+              `[SecureChannel] ${label}: Welcome for ${t2.deviceId.slice(0, 8)} was NOT written \u2014 leaving the request PENDING so the next pull retries it`
+            );
+            continue;
+          }
+          if (await this._postFulfilWelcome(mlsGroupId, t2.requestId, `${label} ${t2.deviceId.slice(0, 8)}`)) {
+            fulfilled++;
+          }
+        }
+        return fulfilled;
+      }
+      /**
+       * Resolve an MLS group id to the family that owns it.
+       *
+       * There are four: rooms, A2A channels, shared 1:1 groups, and the legacy
+       * per-conversation groups. They all store the MLS group id under
+       * `mlsGroupId`; they differ only in the key their live `MLSGroupManager` sits
+       * under in `_mlsGroups`.
+       *
+       * ONE resolver, because hand-copying this enumeration is what produced
+       * #1012 (`_handleMlsCommit` handled two families of four), #1014 (a
+       * room-framed 1:1 replay matched nothing) and #1016 (a rejoin dropped only
+       * the room manager). Three bugs, one missing abstraction.
+       */
+      _resolveGroupFamily(mlsGroupId) {
+        if (!mlsGroupId) return null;
+        const families = [
+          { family: "room", entries: this._persisted?.rooms, managerKey: (id) => id, label: "room" },
+          { family: "a2a", entries: this._persisted?.a2aChannels, managerKey: (id) => `a2a:${id}`, label: "A2A" },
+          { family: "shared1to1", entries: this._persisted?.mlsGroups, managerKey: (id) => `1to1-group:${id}`, label: "1:1 group" },
+          { family: "conversation", entries: this._persisted?.mlsConversations, managerKey: (id) => `conv:${id}`, label: "conversation" }
+        ];
+        for (const f2 of families) {
+          for (const [id, entry] of Object.entries(f2.entries ?? {})) {
+            if (entry?.mlsGroupId !== mlsGroupId) continue;
+            return {
+              family: f2.family,
+              id,
+              managerKey: f2.managerKey(id),
+              label: `${f2.label} ${id.slice(0, 8)}`
+            };
+          }
+        }
+        return null;
+      }
+      /** #1015: is the socket in a state that can actually take a write? */
+      _wsIsOpen() {
+        return this._ws?.readyState === 1;
+      }
+      /**
+       * #1015: write one frame and report whether the socket took it.
+       *
+       * `ws.send()` on a CLOSING or CLOSED socket returns WITHOUT throwing — the
+       * error surfaces only through the callback, and every fulfilment site passed
+       * none. So a Welcome could be "sent" into a dead socket and the requester
+       * still marked `fulfilled`, which it never re-requests.
+       */
+      _sendFrameConfirmed(frame, label) {
+        const ws = this._ws;
+        if (!ws || ws.readyState !== 1) {
+          console.warn(
+            `[SecureChannel] ${label}: socket is not OPEN (readyState=${ws?.readyState ?? "null"}) \u2014 frame NOT written`
+          );
+          return Promise.resolve(false);
+        }
+        return new Promise((resolve3) => {
+          try {
+            ws.send(JSON.stringify(frame), (err) => {
+              if (err) {
+                console.error(`[SecureChannel] ${label}: socket refused the frame:`, err);
+                resolve3(false);
+              } else {
+                resolve3(true);
+              }
+            });
+          } catch (err) {
+            console.error(`[SecureChannel] ${label}: send threw:`, err);
+            resolve3(false);
+          }
+        });
+      }
+      /**
+       * #1015: record a Welcome as fulfilled — and say so when it fails.
+       *
+       * The batched shared-1:1 site posted this with `.catch(() => {})`, so an HTTP
+       * failure here was invisible on top of the sends being invisible.
+       */
+      async _postFulfilWelcome(mlsGroupId, requestId, label) {
+        try {
+          const res = await fetch(
+            `${this.config.apiUrl}/api/v1/mls/groups/${mlsGroupId}/fulfill-welcome`,
+            {
+              method: "POST",
+              headers: { Authorization: `Bearer ${this._deviceJwt}`, "Content-Type": "application/json" },
+              body: JSON.stringify({ request_id: requestId })
+            }
+          );
+          if (!res.ok) {
+            console.warn(`[SecureChannel] ${label}: fulfill-welcome returned ${res.status}`);
+            return false;
+          }
+          return true;
+        } catch (err) {
+          console.warn(`[SecureChannel] ${label}: fulfill-welcome failed:`, err);
+          return false;
+        }
+      }
+      /**
+       * #1013: fold an epoch seen on an inbound frame into the running hint.
+       *
+       * Anything unusable (missing, non-numeric, negative, fractional) is ignored
+       * rather than defaulted. A defaulted epoch here would be a guess, and a guess
+       * that reads LOW silently disables the check it exists to drive.
+       */
+      _noteGroupEpoch(mlsGroupId, epoch) {
+        if (typeof mlsGroupId !== "string" || !mlsGroupId) return;
+        const current = this._observedGroupEpochs.get(mlsGroupId) ?? 0;
+        const next = noteObservedEpoch(current, epoch);
+        if (next > current) this._observedGroupEpochs.set(mlsGroupId, next);
+      }
+      /**
+       * #1013 — the ONLY place this package encrypts an MLS application message.
+       *
+       * Catch up first when the group is known to have moved past us, then encrypt.
+       * Hermes has done this since #440 and the browser since #996; the plugin —
+       * the implementation that actually ships to customers — did not, so an agent
+       * that missed one commit encrypted every later message at an epoch nobody
+       * could read, while the server stored and relayed it and every signal read
+       * 200.
+       *
+       * Funnelling every sender through one method is the point. A guard applied at
+       * seven call sites decays to a guard applied at six: that is exactly how
+       * `_handleMlsCommit` ended up handling two group families out of four (#1012).
+       *
+       * Best-effort by design. A catch-up that cannot replay — or that throws — must
+       * NOT block the send; we fall through and encrypt at the local epoch, which is
+       * precisely today's behaviour, so the worst case is no regression.
+       */
+      async _encryptWithCatchUp(mlsGroup, groupKey, mlsGroupId, label, plaintextBytes) {
+        const observed = this._observedGroupEpochs.get(mlsGroupId);
+        if (observed !== void 0 && needsPreSendResync(Number(mlsGroup.epoch), observed)) {
+          console.warn(
+            `[SecureChannel] ${label}: local epoch ${Number(mlsGroup.epoch)} is behind the observed group epoch ${observed} \u2014 catching up before encrypt (#1013)`
+          );
+          try {
+            if (!await this._resyncOnDivergence(groupKey, mlsGroupId)) {
+              console.warn(
+                `[SecureChannel] ${label}: catch-up could not replay \u2014 sending at epoch ${Number(mlsGroup.epoch)}. Peers past this epoch will not read it.`
+              );
+            }
+          } catch (err) {
+            console.warn(`[SecureChannel] ${label}: catch-up failed:`, err);
+          }
+        }
+        return await mlsGroup.encrypt(plaintextBytes);
+      }
       async _resyncOnDivergence(groupKey, groupId) {
         const mgr = this._mlsGroups.get(groupKey);
         if (!mgr?.isInitialized) return false;
@@ -70317,11 +70702,24 @@ ${messageText}`;
             applied++;
           }
           if (applied === 0) {
-            console.log(`[SecureChannel] Resync for ${groupId.slice(0, 8)}: no new commits to apply (epoch=${mgr.epoch})`);
+            const strikes = (this._resyncNoOpStrikes.get(groupKey) ?? 0) + 1;
+            this._resyncNoOpStrikes.set(groupKey, strikes);
+            if (strikes < _SecureChannel.MAX_RESYNC_NOOPS) {
+              this._mlsDecryptFailCounts.delete(groupKey);
+              console.log(
+                `[SecureChannel] Resync for ${groupId.slice(0, 8)}: already current at epoch=${mgr.epoch} (strike ${strikes}/${_SecureChannel.MAX_RESYNC_NOOPS}) \u2014 NOT re-keying (#1084)`
+              );
+              return true;
+            }
+            this._resyncNoOpStrikes.delete(groupKey);
+            console.warn(
+              `[SecureChannel] Resync for ${groupId.slice(0, 8)}: still failing at epoch=${mgr.epoch} after ${_SecureChannel.MAX_RESYNC_NOOPS} no-op resyncs \u2014 escalating to re-key`
+            );
             return false;
           }
           await saveMlsState(this.config.dataDir, groupId, JSON.stringify(mgr.exportState()));
           this._mlsDecryptFailCounts.delete(groupKey);
+          this._resyncNoOpStrikes.delete(groupKey);
           console.log(
             `[SecureChannel] Resync-on-divergence: applied ${applied} missed commit(s) for ${groupId.slice(0, 8)}, now epoch=${mgr.epoch}`
           );
@@ -70708,6 +71106,7 @@ ${messageText}`;
             const ackedIds = [];
             const nackedIds = [];
             for (const msg of messages) {
+              let handled = true;
               try {
                 if (msg.sender_device_id === this._deviceId) {
                   ackedIds.push(msg.queue_id);
@@ -70724,7 +71123,7 @@ ${messageText}`;
                     a2a_channel_id: msg.a2a_channel_id
                   });
                 } else if (msg.message_type === "commit") {
-                  await this._handleMlsCommit({
+                  handled = await this._handleMlsCommit({
                     group_id: msg.group_id,
                     sender_device_id: msg.sender_device_id,
                     epoch: msg.epoch,
@@ -70762,9 +71161,18 @@ ${messageText}`;
                       conversation_group_id: msg.conversation_group_id,
                       created_at: msg.created_at
                     });
+                  } else {
+                    handled = false;
+                    console.warn(
+                      `[SecureChannel] Delivery application row ${String(msg.message_id).slice(0, 8)} names no room, A2A channel or conversation \u2014 NOT acked`
+                    );
                   }
                 }
-                ackedIds.push(msg.queue_id);
+                if (handled) {
+                  ackedIds.push(msg.queue_id);
+                } else {
+                  nackedIds.push(msg.queue_id);
+                }
               } catch (err) {
                 console.warn(`[SecureChannel] Delivery ${msg.message_type} processing failed:`, err);
                 nackedIds.push(msg.queue_id);
@@ -70833,38 +71241,20 @@ ${messageText}`;
                   if (!kpHex) continue;
                   const kpBytes = new Uint8Array(Buffer.from(kpHex, "hex"));
                   const memberKp = MLSGroupManager.deserializeKeyPackage(kpBytes);
-                  const { commit, welcome } = await mlsGroup.addMembers([memberKp]);
-                  if (this._ws) {
-                    this._ws.send(JSON.stringify({
-                      event: "mls_commit",
-                      data: {
-                        group_id: roomState.mlsGroupId,
-                        epoch: Number(mlsGroup.epoch),
-                        payload: Buffer.from(commit).toString("hex")
-                      }
-                    }));
-                  }
-                  if (welcome && this._ws) {
-                    this._ws.send(JSON.stringify({
-                      event: "mls_welcome",
-                      data: {
-                        target_device_id: req.requesting_device_id,
-                        group_id: roomState.mlsGroupId,
-                        room_id: roomId,
-                        payload: Buffer.from(welcome).toString("hex")
-                      }
-                    }));
+                  const done = await this._fulfilWelcomeRequests({
+                    mlsGroup,
+                    mlsGroupId: roomState.mlsGroupId,
+                    label: `room ${roomId.slice(0, 8)}`,
+                    welcomeFields: { room_id: roomId },
+                    targets: [{
+                      requestId: req.id,
+                      deviceId: req.requesting_device_id,
+                      keyPackage: memberKp
+                    }]
+                  });
+                  if (done > 0) {
+                    console.log(`[SecureChannel] Fulfilled Welcome for ${req.requesting_device_id.slice(0, 8)} in room ${roomId.slice(0, 8)}`);
                   }
-                  await fetch(
-                    `${this.config.apiUrl}/api/v1/mls/groups/${roomState.mlsGroupId}/fulfill-welcome`,
-                    {
-                      method: "POST",
-                      headers: { Authorization: `Bearer ${this._deviceJwt}`, "Content-Type": "application/json" },
-                      body: JSON.stringify({ request_id: req.id })
-                    }
-                  );
-                  await saveMlsState(this.config.dataDir, roomState.mlsGroupId, JSON.stringify(mlsGroup.exportState()));
-                  console.log(`[SecureChannel] Fulfilled Welcome for ${req.requesting_device_id.slice(0, 8)} in room ${roomId.slice(0, 8)}`);
                 } catch (fulfillErr) {
                   console.warn(`[SecureChannel] Welcome fulfill failed for ${req.requesting_device_id.slice(0, 8)}:`, fulfillErr);
                 }
@@ -70903,65 +71293,38 @@ ${messageText}`;
                 validReqs.push({ req, kp: MLSGroupManager.deserializeKeyPackage(kpBytes) });
               }
               if (validReqs.length === 0) continue;
+              const sharedTargets = validReqs.map((v2) => ({
+                requestId: v2.req.id,
+                deviceId: v2.req.requesting_device_id,
+                keyPackage: v2.kp
+              }));
               try {
-                const { commit, welcome } = await mlsGroup.addMembers(validReqs.map((v2) => v2.kp));
-                if (this._ws) {
-                  this._ws.send(JSON.stringify({
-                    event: "mls_commit",
-                    data: {
-                      group_id: entry.mlsGroupId,
-                      epoch: Number(mlsGroup.epoch),
-                      payload: Buffer.from(commit).toString("hex")
-                    }
-                  }));
-                }
-                if (welcome && this._ws) {
-                  for (const { req } of validReqs) {
-                    this._ws.send(JSON.stringify({
-                      event: "mls_welcome",
-                      data: {
-                        target_device_id: req.requesting_device_id,
-                        group_id: entry.mlsGroupId,
-                        conversation_group_id: gid,
-                        payload: Buffer.from(welcome).toString("hex")
-                      }
-                    }));
-                  }
-                }
-                for (const { req } of validReqs) {
-                  await fetch(
-                    `${this.config.apiUrl}/api/v1/mls/groups/${entry.mlsGroupId}/fulfill-welcome`,
-                    {
-                      method: "POST",
-                      headers: { Authorization: `Bearer ${this._deviceJwt}`, "Content-Type": "application/json" },
-                      body: JSON.stringify({ request_id: req.id })
-                    }
-                  ).catch(() => {
-                  });
+                const done = await this._fulfilWelcomeRequests({
+                  mlsGroup,
+                  mlsGroupId: entry.mlsGroupId,
+                  label: `shared group ${gid.slice(0, 8)}`,
+                  welcomeFields: { conversation_group_id: gid },
+                  targets: sharedTargets
+                });
+                if (done > 0) {
+                  console.log(`[SecureChannel] Batched Welcome for ${done}/${validReqs.length} devices in shared group ${gid.slice(0, 8)} (epoch=${mlsGroup.epoch})`);
                 }
-                await saveMlsState(this.config.dataDir, entry.mlsGroupId, JSON.stringify(mlsGroup.exportState()));
-                console.log(`[SecureChannel] Batched Welcome for ${validReqs.length} devices in shared group ${gid.slice(0, 8)} (epoch=${mlsGroup.epoch})`);
               } catch (batchErr) {
                 console.warn(`[SecureChannel] Batched Welcome failed for shared group ${gid.slice(0, 8)}, falling back to individual:`, batchErr);
-                for (const { req, kp } of validReqs) {
+                for (const target of sharedTargets) {
                   try {
-                    const { commit, welcome } = await mlsGroup.addMembers([kp]);
-                    if (this._ws) {
-                      this._ws.send(JSON.stringify({ event: "mls_commit", data: { group_id: entry.mlsGroupId, epoch: Number(mlsGroup.epoch), payload: Buffer.from(commit).toString("hex") } }));
-                    }
-                    if (welcome && this._ws) {
-                      this._ws.send(JSON.stringify({ event: "mls_welcome", data: { target_device_id: req.requesting_device_id, group_id: entry.mlsGroupId, conversation_group_id: gid, payload: Buffer.from(welcome).toString("hex") } }));
-                    }
-                    await fetch(`${this.config.apiUrl}/api/v1/mls/groups/${entry.mlsGroupId}/fulfill-welcome`, {
-                      method: "POST",
-                      headers: { Authorization: `Bearer ${this._deviceJwt}`, "Content-Type": "application/json" },
-                      body: JSON.stringify({ request_id: req.id })
-                    }).catch(() => {
+                    const done = await this._fulfilWelcomeRequests({
+                      mlsGroup,
+                      mlsGroupId: entry.mlsGroupId,
+                      label: `shared group ${gid.slice(0, 8)}`,
+                      welcomeFields: { conversation_group_id: gid },
+                      targets: [target]
                     });
-                    await saveMlsState(this.config.dataDir, entry.mlsGroupId, JSON.stringify(mlsGroup.exportState()));
-                    console.log(`[SecureChannel] Individual Welcome for ${req.requesting_device_id.slice(0, 8)} in shared group ${gid.slice(0, 8)}`);
+                    if (done > 0) {
+                      console.log(`[SecureChannel] Individual Welcome for ${target.deviceId.slice(0, 8)} in shared group ${gid.slice(0, 8)}`);
+                    }
                   } catch (indivErr) {
-                    console.warn(`[SecureChannel] Individual Welcome failed for ${req.requesting_device_id.slice(0, 8)}:`, indivErr);
+                    console.warn(`[SecureChannel] Individual Welcome failed for ${target.deviceId.slice(0, 8)}:`, indivErr);
                   }
                 }
               }
@@ -70993,38 +71356,20 @@ ${messageText}`;
                   if (!kpHex) continue;
                   const kpBytes = new Uint8Array(Buffer.from(kpHex, "hex"));
                   const memberKp = MLSGroupManager.deserializeKeyPackage(kpBytes);
-                  const { commit, welcome } = await mlsGroup.addMembers([memberKp]);
-                  if (this._ws) {
-                    this._ws.send(JSON.stringify({
-                      event: "mls_commit",
-                      data: {
-                        group_id: convEntry.mlsGroupId,
-                        epoch: Number(mlsGroup.epoch),
-                        payload: Buffer.from(commit).toString("hex")
-                      }
-                    }));
-                  }
-                  if (welcome && this._ws) {
-                    this._ws.send(JSON.stringify({
-                      event: "mls_welcome",
-                      data: {
-                        target_device_id: req.requesting_device_id,
-                        group_id: convEntry.mlsGroupId,
-                        conversation_id: convId,
-                        payload: Buffer.from(welcome).toString("hex")
-                      }
-                    }));
+                  const done = await this._fulfilWelcomeRequests({
+                    mlsGroup,
+                    mlsGroupId: convEntry.mlsGroupId,
+                    label: `conv ${convId.slice(0, 8)}`,
+                    welcomeFields: { conversation_id: convId },
+                    targets: [{
+                      requestId: req.id,
+                      deviceId: req.requesting_device_id,
+                      keyPackage: memberKp
+                    }]
+                  });
+                  if (done > 0) {
+                    console.log(`[SecureChannel] Fulfilled Welcome for ${req.requesting_device_id.slice(0, 8)} in conv ${convId.slice(0, 8)}`);
                   }
-                  await fetch(
-                    `${this.config.apiUrl}/api/v1/mls/groups/${convEntry.mlsGroupId}/fulfill-welcome`,
-                    {
-                      method: "POST",
-                      headers: { Authorization: `Bearer ${this._deviceJwt}`, "Content-Type": "application/json" },
-                      body: JSON.stringify({ request_id: req.id })
-                    }
-                  );
-                  await saveMlsState(this.config.dataDir, convEntry.mlsGroupId, JSON.stringify(mlsGroup.exportState()));
-                  console.log(`[SecureChannel] Fulfilled Welcome for ${req.requesting_device_id.slice(0, 8)} in conv ${convId.slice(0, 8)}`);
                 } catch (fulfillErr) {
                   console.warn(`[SecureChannel] Conv Welcome fulfill failed for ${req.requesting_device_id.slice(0, 8)}:`, fulfillErr);
                 }
@@ -71205,12 +71550,13 @@ ${messageText}`;
                   } catch (distErr) {
                     console.warn(`[SecureChannel] A2A distribute network error:`, distErr);
                   }
-                  if (!distributed && this._ws) {
-                    this._ws.send(JSON.stringify({
+                  if (!distributed && this._wsIsOpen()) {
+                    const a2aLabel = `A2A ${chId.slice(0, 8)}`;
+                    const commitSent = await this._sendFrameConfirmed({
                       event: "mls_commit",
                       data: { group_id: chState.mlsGroupId, epoch: Number(mlsGroup.epoch), payload: commitHex }
-                    }));
-                    this._ws.send(JSON.stringify({
+                    }, `${a2aLabel} commit`);
+                    const welcomeSent = commitSent && await this._sendFrameConfirmed({
                       event: "mls_welcome",
                       data: {
                         target_device_id: req.requesting_device_id,
@@ -71218,7 +71564,11 @@ ${messageText}`;
                         a2a_channel_id: chId,
                         payload: welcomeHex
                       }
-                    }));
+                    }, `${a2aLabel} welcome`);
+                    if (!welcomeSent) {
+                      console.warn(`[SecureChannel] ${a2aLabel}: Welcome frames were NOT written \u2014 leaving the request pending`);
+                      continue;
+                    }
                     try {
                       await fetch(
                         `${this.config.apiUrl}/api/v1/mls/groups/${chState.mlsGroupId}/distribute`,
@@ -71241,16 +71591,15 @@ ${messageText}`;
                     console.warn(`[SecureChannel] Cannot deliver Welcome \u2014 HTTP distribute and WS both unavailable`);
                     continue;
                   }
-                  await fetch(
-                    `${this.config.apiUrl}/api/v1/mls/groups/${chState.mlsGroupId}/fulfill-welcome`,
-                    {
-                      method: "POST",
-                      headers: { Authorization: `Bearer ${this._deviceJwt}`, "Content-Type": "application/json" },
-                      body: JSON.stringify({ request_id: req.id })
-                    }
+                  const a2aFulfilled = await this._postFulfilWelcome(
+                    chState.mlsGroupId,
+                    req.id,
+                    `A2A ${chId.slice(0, 8)}`
                   );
                   await saveMlsState(this.config.dataDir, chState.mlsGroupId, JSON.stringify(mlsGroup.exportState()));
-                  console.log(`[SecureChannel] Fulfilled A2A Welcome for ${req.requesting_device_id.slice(0, 8)} in channel ${chId.slice(0, 8)}`);
+                  if (a2aFulfilled) {
+                    console.log(`[SecureChannel] Fulfilled A2A Welcome for ${req.requesting_device_id.slice(0, 8)} in channel ${chId.slice(0, 8)}`);
+                  }
                 } catch (fulfillErr) {
                   console.log(`[SecureChannel] A2A Welcome fulfill failed: ${fulfillErr instanceof Error ? fulfillErr.message : String(fulfillErr)}`);
                 }
@@ -71424,12 +71773,12 @@ ${messageText}`;
           console.log(`[SecureChannel] MLS sync: re-join needed for group ${groupId?.slice(0, 8)}`);
           if (groupId) {
             await deleteMlsState(this.config.dataDir, groupId);
-            for (const [roomId, room] of Object.entries(this._persisted?.rooms ?? {})) {
-              if (room.mlsGroupId === groupId) {
-                this._mlsGroups.delete(roomId);
-                break;
-              }
+            const target = this._resolveGroupFamily(groupId);
+            if (target) {
+              this._mlsGroups.delete(target.managerKey);
+              console.log(`[SecureChannel] MLS sync rejoin: dropped local state for ${target.label}`);
             }
+            void this._requestWelcomeSelfHeal(groupId);
           }
         } else if (action === "replay_complete") {
           console.log(`[SecureChannel] MLS sync complete for group ${groupId?.slice(0, 8)} (${data.count} messages replayed)`);
@@ -71441,6 +71790,7 @@ ${messageText}`;
        */
       async _handleA2AMessageMLS(data) {
         const groupId = data.group_id;
+        this._noteGroupEpoch(groupId, data.epoch);
         const channelId = data.channel_id ?? data.a2a_channel_id;
         let a2aChannelId = channelId;
         if (!a2aChannelId) {
@@ -98664,7 +99014,7 @@ var init_index = __esm2({
     init_skill_invoker();
     await init_skill_telemetry();
     await init_policy_enforcer();
-    VERSION = true ? "0.23.23" : "0.0.0-dev";
+    VERSION = true ? "0.23.27" : "0.0.0-dev";
   }
 });
 await init_index();
@@ -99567,7 +99917,7 @@ async function main() {
   const info = parseInfoFlags(process.argv.slice(2));
   if (info.showVersion || info.showHelp) {
     const version2 = buildClientVersion2(
-      true ? "0.4.0" : void 0
+      true ? "0.4.1" : void 0
     );
     if (info.showVersion) printLine(version2);
     if (info.showHelp) {
@@ -99620,7 +99970,7 @@ async function main() {
     agentName: cfg.agentName,
     platform: "node",
     clientVersion: buildClientVersion2(
-      true ? "0.4.0" : void 0
+      true ? "0.4.1" : void 0
     )
   });
   channelRef = channel;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentvault/grok-bridge",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "type": "module",
   "description": "AgentVault Grok Bridge — daemon bridging a Grok agent into E2E-encrypted AgentVault direct messages and rooms.",
   "main": "dist/index.js",